CVE-2025-69199: 
NixOS vulnerability analysis and mitigation

CVE-2025-69199 is a denial-of-service vulnerability in Pterodactyl Wings, the server control plane for the open-source game server management panel. The flaw stems from the absence of rate limiting and throttling on WebSocket connections, allowing low-privileged users to exhaust host network, CPU, and memory resources. All Wings versions prior to 1.12.0 are affected. The advisory was published on January 19, 2026, with a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 8.3 (High) (GitHub Advisory, Pterodactyl Advisory).

The root cause is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). Wings' WebSocket endpoints impose no restrictions on the number of concurrent connections a user may open, nor on the total size of messages sent or received over those connections. An attacker with low-level panel access can open thousands of simultaneous WebSocket connections and flood them with large payloads, triggering resource exhaustion on the host. No complex preconditions are required beyond possessing a valid (potentially free-tier) account on the Pterodactyl panel (GitHub Advisory, Pterodactyl Advisory).

Successful exploitation results in a denial-of-service condition affecting the availability of the Wings daemon and the underlying host system. An attacker can saturate host network bandwidth, exhaust available memory, and spike CPU utilization to the point where the Wings service becomes unresponsive, disrupting all game servers managed by the affected node. There is no confidentiality or integrity impact; the attack is purely an availability concern, but it can affect all tenants sharing the same Wings host (GitHub Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.081% (24th percentile), indicating a low near-term exploitation probability. The attack requires only low privileges (a valid panel account) and no user interaction, making it straightforward to execute if an attacker has panel access (GitHub Advisory).

1. Obtain panel access: Register or obtain a low-privileged account on a Pterodactyl panel instance running Wings prior to version 1.12.0.
2. Identify WebSocket endpoints: Locate the Wings WebSocket endpoints exposed by the panel (typically used for real-time server console and stats streaming).
3. Open mass connections: Use a scripted client (e.g., a Python script using websockets or wscat) to open thousands of simultaneous WebSocket connections to the Wings daemon using the authenticated session token.
4. Flood with large messages: Over each open connection, continuously send oversized messages or repeatedly request data-heavy operations (e.g., log streaming) to maximize data volume transmitted.
5. Sustain the attack: Maintain the connections and message flood to keep host CPU, memory, and network bandwidth saturated, rendering Wings and all managed game servers unavailable (GitHub Advisory, Pterodactyl Advisory).

• Network: Abnormally high number of concurrent WebSocket connections originating from a single or small set of source IPs to the Wings daemon port; sustained high outbound/inbound bandwidth on the Wings host.
• Logs: Wings access logs showing a single user or token establishing hundreds or thousands of WebSocket sessions in a short time window; repeated connection open/close events in Wings daemon logs.
• Process/System: Sustained near-100% CPU utilization by the Wings process (wings binary); rapid growth in Wings process memory consumption; system OOM (out-of-memory) killer events in /var/log/syslog or dmesg referencing the Wings process.
• Application: Game servers on the affected node becoming unresponsive or crashing due to resource starvation on the host.

The primary remediation is to upgrade Wings to version 1.12.0, which introduces proper rate limiting and throttling on WebSocket connections (GitHub Advisory, Pterodactyl Advisory). For operators unable to upgrade immediately, the following network-level mitigations are recommended:

• Implement firewall or load balancer rules to limit the number of concurrent WebSocket connections per source IP to the Wings daemon.
• Apply rate limiting on WebSocket upgrade requests at a reverse proxy (e.g., nginx or Caddy) in front of Wings.
• Monitor and alert on abnormal connection counts or bandwidth spikes from individual panel users.

The vulnerability was reported by security researcher KianBrose and published by the Pterodactyl maintainer anthonyphysgun on January 19, 2026 (Pterodactyl Advisory). A brief technical write-up was published by Infinit Security shortly after disclosure (Infinit Security). No significant broader media coverage or notable social media discussion has been observed beyond standard vulnerability aggregator postings.